Is the USB data between
Boson and application strictly RS-232?

It’s not RS-232 at all. RS-232 is an electrical specification.
For Tau2 cameras, the VPC converts USB transactions to RS-232 which is
then fed to the Tau2. Boson has built-in USB, so it takes USB
unconverted. Commands are transferred over a virtual serial port over
USB, so it is basically the same concept as the communication for Tau2.